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AMENDMENTS TO THE CLAIMS 

1 . (Original) A data processing method including receiving input data containing a 
plurality of instruction codes, and judging whether or not a process executed based on the 
instruction codes contained in the received data is a malicious process, said method being 
characterized by comprising: 

retrieving an instruction code related to a branch instruction from the data; storing a 
branch origin address associated with the retrieved instruction code and a branch destination 
address associated with a branch destination of the instruction code; judging whether or not an 
instruction code for calling an instruction code group for executing a predetermined process is 
associated with the branch destination address; storing a call destination address of the 
instruction code if the instruction code is associated with the branch destination address; and 
judging whether or not the stored call destination address is between the branch origin address 
and the branch destination address. 

2. (Original) A data processor including means for receiving input data containing a 
plurality of instruction codes, forjudging whether or not a process executed based on the 
instruction codes contained in the received data is a malicious process, said data processor being 
characterized by comprising: 

means for retrieving an instruction code related to a branch instruction from the data; 

means for storing a branch origin address associated with the retrieved instruction code and a 

branch destination address associated with a branch destination of the instruction code; means 

forjudging whether or not an instruction code for calling an instruction code group for executing 
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a predetermined process is associated with the branch destination address; storing a call 
destination address of the instruction code if the instruction code is associated with the branch 
destination address; means forjudging whether or not the stored call destination address is 
between the branch origin address and the branch destination address; and means for outputting 
information indicating that the data is data for executing a malicious process if the call 
destination address is between the branch origin address and the branch destination address. 

3. (Original) The data processor as set forth in claim 2, characterized by further 

comprising means forjudging whether or not a predetermined character string is associated with 
a return address of the instruction code group, wherein if the character string is associated with 
the return address, the information indicating that the data is data for executing a malicious 
process is outputted. 

4. (Original) A data processor including means for receiving input data containing a 
plurality of instruction codes, forjudging whether or not a process executed based on the 
instruction codes contained in the data received by the means is a malicious process, said data 
processor being characterized by comprising: 

means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; means forjudging whether or not a 
predetermined character string is associated with a retum address of the instruction code group; 
and means for outputting information indicating that the data is data for executing a malicious 
process if the character string is associated with the return address. 
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5. (Original) A data processor including means for receiving input data containing a 
plurality of instruction codes, forjudging whether or not a process executed based on the 
instruction codes contained in the data received by the means is a malicious process, said data 
processor being characterized by comprising: 

means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; means forjudging whether or not an 
instruction code for obtaining a return address of the instruction code group is contained in the 
instruction code group if the instruction code is retrieved; and means for outputting information 
indicating that the data is data for executing a malicious process if the instruction code is 
contained in the instruction code group. 

6. (Canceled) 

7. (Original) A computer-readable memory product storing a computer program 
including a step of causing a computer to judge whether or not a process executed based on input 
data containing a plurality of instruction codes is a malicious process, characterized in that the 
stored computer program comprises: 

a step of causing the computer to retrieve an instruction code related to a branch 
instruction from the data; a step of causing the computer to store a branch origin address 
associated with the retrieved instruction code and a branch destination address associated with a 
branch destination of the instruction code; a step of causing the computer to judge whether or not 
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an instruction code for calling an instruction code group for executing a predetermined process is 
associated with the branch destination address; a step of causing the computer to store a call 
destination address of the instruction code if the instruction code is associated with the branch 
destination address; and a step of causing the computer to judge whether or not the stored call 
destination address is between the branch origin address and the branch destination address. 
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